1. WHO WE ARE

The Riff Music Academy provides personalised music education services across London.

Business Details:

• Trading Name: The Riff Music Academy
• Business Structure: Sole Trader
• Contact Email: info@theriffacademy.co.uk
• Phone: +44 7704 829065
• Service Area: Greater London
 
ICO Registration: ZC080806

This Privacy Policy explains how we collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. INFORMATION WE COLLECT

We only collect personal information necessary to provide music lessons and manage our service.

2.1 Information You Provide to Us
 
When you book lessons or contact us, we collect:

For Students (Adults):

• Full name
• Date of birth (age)
• Email address
• Phone number
• Home address (for home lessons)
• Musical experience and goals
• Preferred lesson times
• Payment information (processed securely via third-party payment processors)
• Any special requirements (e.g., accessibility needs)

For Students (Children under 18):

• Child's full name
• Child's date of birth (age)
• Parent/guardian full name
• Parent/guardian email address
• Parent/guardian phone number
• Home address (for home lessons)
• Emergency contact details
• Child's musical experience and goals
• Preferred lesson times
• Any special requirements or relevant medical information
• Payment information (processed via parent/guardian)

Optional Information:

• Examination history (if taking graded exams)
• Practice preferences
• Feedback on lessons

2.2 Information We Collect Automatically Website Usage Data:

• IP address
• Browser type and version
• Pages visited and time spent
• Referring website
• Device information

We use cookies and similar technologies. See Section 11 for details.

2.3 Information from Third Parties

• Payment confirmation from payment processors (Stripe, etc.)
• Exam results from ABRSM or Trinity College London (only with your consent)

3. HOW WE USE YOUR INFORMATION

3.1 Legal Basis for Processing

We process your personal data under the following legal bases: Contract (Article 6(1)(b) GDPR): • To provide music lessons you've booked
• To arrange and schedule lessons
• To communicate with you about your lessons
• To process payments

Legitimate Interests (Article 6(1)(f) GDPR):
• To improve our services
• To manage our business operations
• To prevent fraud
• To respond to enquiries

Consent (Article 6(1)(a) GDPR):
• To send marketing communications (you can opt out anytime)
• To take photographs/videos for promotional use
• To share your exam results

Legal Obligation (Article 6(1)(c) GDPR):
• To comply with tax and accounting requirements
• To respond to legal requests

3.2 How We Use Your Data

Lesson Delivery:

• Matching you with appropriate tutors
• Scheduling and confirming lessons
• Sharing necessary information with your tutor (name, age, address for home lessons, contact details, musical goals)
• Tracking attendance and progress
• Providing feedback

Administrative:

• Processing payments and invoices
• Maintaining financial records
• Managing bookings and cancellations
• Responding to queries

Communications:

• Sending lesson confirmations
• Providing important updates about lessons
• Responding to your enquiries
• Sending marketing emails (only with consent)

Service Improvement:

• Analysing feedback to improve our service
• Understanding customer needs
• Training tutors

4. WHO WE SHARE YOUR DATA WITH

We do not sell, rent, or trade your personal information to third parties.

4.1 Tutors (Data Processors)

We share necessary information with your assigned tutor:

• Student name and age
• Contact details (parent/guardian for minors)
• Address (for home lessons)
• Lesson preferences and goals
• Progress notes

Tutor Obligations:

All tutors sign a Data Processing Agreement requiring them to:

• Keep your data confidential
• Use data only for teaching purposes
• Store data securely
• Delete data when no longer needed
• Report any data breaches immediately

4.2 Payment Processors

We use secure third-party payment processors:

• Stripe
• They process payment information according to PCI-DSS standards
• We do NOT store your full card details

4.3 Service Providers

We may share data with:

• Accounting/bookkeeping services (for financial record keeping)
• Email service providers for communications (only with consent)
• Website hosting providers – for website operation
• IT support providers – for system maintenance

All service providers are contractually required to protect your data.

4.4 Legal Requirements

We may disclose your information if:

• Required by law or legal process
• Necessary to protect our rights or safety
• Required by HMRC, tax authorities, or regulatory bodies

5. HOW LONG WE KEEP YOUR DATA

Active Students:

• We keep your data for the duration of your lessons and up to 3 years after your last lesson
Why 3 Years?
• Legal requirement for financial records (6 years from end of accounting year)
• To handle any queries or disputes
• To maintain historical records of progress

After 3 Years:
• We securely delete or anonymize your data
• Exception: Financial records kept for 7 years (legal requirement)

If You Request Deletion:

• We will delete your data immediately, except where we must keep it for legal reasons (e.g., tax records)

6. HOW WE PROTECT YOUR DATA

6.1 Security Measures Technical Security:

• Encrypted data storage
• Password-protected systems
• Secure payment processing (PCI-DSS compliant)
• Regular security updates
• Firewall and anti-virus protection
• Secure cloud storage (e.g., Google Drive with 2-factor authentication)

Organizational Security:

• Limited access – only staff who need it can access data
• Confidentiality agreements with all tutors and staff
• Data protection training
• Clear data handling procedures
• Regular security audits

6.2 Data Breaches If a data breach occurs:

• We will assess the risk to your rights
• If high risk, we'll notify you within 72 hours
• We'll notify the ICO within 72 hours (legal requirement)
• We'll take immediate steps to secure data and prevent further breaches

7. YOUR RIGHTS UNDER GDPR

You have the following rights:

7.1 Right to Access (Article 15)

Request a copy of all personal data we hold about you.
How: Email info@theriffacademy.com
Response Time: Within 30 days (free of charge)

7.2 Right to Rectification (Article 16)

Correct any inaccurate or incomplete data.

How: Email us with corrections Response
Time: Within 30 days

7.3 Right to Erasure / "Right to be Forgotten" (Article 17)

Request deletion of your data (subject to legal retention requirements).

How: Email info@theriffacademy.com
Response Time: Within 30 days
Exception: We must keep financial records for 7 years

7.4 Right to Restrict Processing (Article 18)

Ask us to stop using your data while you challenge its accuracy or our use.

7.5 Right to Data Portability (Article 20)

Receive your data in a commonly used format (e.g., CSV, PDF) to transfer to another service.

7.6 Right to Object (Article 21)

Object to us processing your data for marketing or legitimate interests.

How to Opt Out of Marketing:
• Click "unsubscribe" in any marketing email
• Email info@theriffacademy.com

7.7 Rights Related to Automated Decision-Making

We do NOT use automated decision-making or profiling.


8. CHILDREN'S DATA

We take extra care with children's data.

8.1 Parental Consent For children under 13:

• We require explicit parental/guardian consent before collecting any data
• Parents/guardians have full control over their child's data
• Parents can request to see, correct, or delete their child's data at any time

For children aged 13-17:

• We still require parental awareness and involvement
• Parents/guardians remain the primary contact

8.2 What We Collect About Children

We only collect:

• Name, age, contact details (via parent/guardian)
• Musical experience and goals
• Lesson attendance and progress

We do NOT:

• Collect unnecessary data
• Use children's data for marketing without consent
• Share children's data except with their assigned tutor
• Keep children's data longer than necessary

8.3 Safeguarding

All tutors are Enhanced DBS checked and safeguarding trained. If we have concerns about a child's welfare, we may need to share information with relevant authorities (legal obligation).

9. INTERNATIONAL TRANSFERS

We do NOT transfer your data outside the UK. All data is stored on UK-based servers or with service providers with UK data centres.

If we ever need to transfer data internationally, we will:
• Ensure adequate safeguards are in place
• Notify you in advance
• Only use countries with adequate data protection

10. MARKETING COMMUNICATIONS

10.1 How We Use Marketing Data With your consent, we may send:

• News about lessons and new instruments
• Special offers and promotions
• Tips for music practice
• Updates about The Riff Music Academy

We will NEVER:

• Spam you with excessive emails
• Share your email with third parties for marketing
• Send marketing to children

10.2 Opting Out You can opt out anytime by:

• Clicking "unsubscribe" in any marketing email
• Emailing info@theriffacademy.com
• Calling +44 7704 829065

Important: Opting out of marketing does NOT affect lesson-related communications (confirmations, schedules, invoices).

11. COOKIES AND WEBSITE TRACKING

11.1 What Are Cookies?
Cookies are small text files stored on your device when you visit our website.

11.2 Cookies We Use Essential Cookies (Always Active):

• Enable website functionality
• Remember your booking information
• Maintain security

Analytics Cookies:

• Google Analytics – to understand website usage
• We anonymize IP addresses

Marketing Cookies:

• Facebook Pixel, Google Ads
• Track effectiveness of advertising

11.3 Managing Cookies

You can control cookies through:

• Your browser settings (block all cookies, or only third-party)
• Our cookie consent banner (when you first visit)
Note: Blocking essential cookies may affect website functionality.

11.4 Third-Party Cookies

Our website may include content from:
• Google Maps (for location services)
• YouTube (for video content)
These third parties may set their own cookies. We don't control these cookies.

12. THIRD-PARTY LINKS

Our website may contain links to external websites (e.g., music exam boards, instrument retailers).
We are NOT responsible for:
 
• The privacy practices of external websites
• Content on external websites
Please read the privacy policies of any websites you visit through our links.

13. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.
When we make changes:

• We'll update the "Last Updated" date at the top
• For significant changes, we'll notify you by email
• Continued use of our service after changes means you accept the new policy

We recommend checking this page periodically.

14. HOW TO CONTACT US

General Data Protection Queries:
Email: info@theriffacademy.com
Phone: +44 7704 829065
Service Area: Greater London

To Exercise Your Rights (Access, Deletion, etc.):
Email: info@theriffacademy.com
Subject Line: "Data Subject Request"
Please include:

• Your full name
• Email address or phone number used for booking
• Details of your request
We will respond within 30 days.

15. RIGHT TO COMPLAIN

If you're unhappy with how we've handled your data, you have the right to complain to the UK data protection authority: Information Commissioner's Office (ICO)
Website: https://ico.org.uk/make-a-complaint/ Phone: 0303 123 1113
Post: Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

We'd appreciate the chance to resolve your concern first – please contact us before escalating to the ICO.

16. CONSENT

By using our services, you confirm that:

• You've read and understood this Privacy Policy
• You consent to us collecting and using your data as described
• If booking for a child, you have parental responsibility and provide consent on their behalf

You can withdraw consent at any time by emailing info@theriffacademy.com

SUMMARY

We collect only necessary data, protect it carefully, use it fairly, and give you full control. Your privacy matters to us. Questions? Contact info@theriffacademy.com